add syslog

src/fgai/cli.py

@@ -9,6 +9,7 @@ from .llm import ollama_summary
 from .logs import read_events, summarize_events
 from .mitigation import FortiGateClient, parse_allowlist, suggest_block_candidates
 from .policies import audit_policies, read_policies
+from .syslog_server import listen_udp_syslog
 
 
 def _print_json(data: object) -> None:
@@ -93,6 +94,11 @@ def fetch_policies(args: argparse.Namespace) -> int:
     return 0
 
 
+def listen_syslog(args: argparse.Namespace) -> int:
+    listen_udp_syslog(args.host, args.port, args.output)
+    return 0
+
+
 def build_parser() -> argparse.ArgumentParser:
     parser = argparse.ArgumentParser(description="Local FortiGate AI/ML inspection tool")
     subparsers = parser.add_subparsers(required=True)
@@ -128,6 +134,12 @@ def build_parser() -> argparse.ArgumentParser:
     fetch.add_argument("--output", help="Write JSON response to this file")
     fetch.set_defaults(func=fetch_policies)
 
+    listener = subparsers.add_parser("listen-syslog", help="Listen for UDP syslog and append to a local log file")
+    listener.add_argument("--host", default="0.0.0.0", help="Bind address")
+    listener.add_argument("--port", type=int, default=5514, help="UDP port. Use 514 only with sudo/capability.")
+    listener.add_argument("--output", default="logs/fg_syslog.jsonl", help="File to append received logs to")
+    listener.set_defaults(func=listen_syslog)
+
     return parser